[JIRA] (IDP-1862) Reuse MFA flow results if all possible methods have already been satisfied

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *resolved* as *Won't Do*

I re-read that thread and best I can tell, the example I was speaking to is not really needed. You NEVER want to apply MFA as a requirement from inside the MFA flow logic, rather you always apply it from outside at the service level with Principal machinery, i.e. defaultAuthenticationFlows. If the SP requires MFA "generally", you can inject a per-user exemption inside the MFA logic and just clear the requirement there when appropriate.

By doing it that way, you fail closed AND you optimize automatically because if the user already did MFA, the existing MFA result will satisfy the SP's policy and it will reuse the result without running your script. It's less code and safer.

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 ) IDP-1862 ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 ) Reuse MFA flow results if all possible methods have already been satisfied ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 )

Change By: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Resolution: Won't Do Status: Open Resolved

( https://shibboleth.atlassian.net/browse/IDP-1862#add-comment?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1862#add-comment?atlOrigin=eyJpIjoiMjAwZjAxMDk1MGU3NDUzOGI5NTg4ZWUyZTRiMDY3ZWYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:8e458bc )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/b532ea9f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-5e4fac7d-42fa-4a12-ad71-fda6494c1691
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/b532ea9f/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-7f76ed55-de2b-4c79-9b78-e5e45d051ce9
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/b532ea9f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e14bf4d3-d50e-47f3-a94c-3ff48fed4abe
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211104/b532ea9f/attachment-0005.png>